VPN service providers advertise with the promise of making Internet browsing more secure and protecting the user’s privacy. They also claim to make it possible using streaming services from other countries. But that’s not enough, they are even supposed to save you money when shopping online. Impressive. But is it true – are vpn worth it? I was asked to be an expert on this for a program on public television, but unfortunately had to cancel it. Nevertheless, I would like to explain my view on the advertising promises of VPN providers like NordVPN, ExpressVPN, ProtonVPN etc. Are VPN services worth it – is it useful or a rip off?
Basics of IP addresses and VPN
There’s no getting around of two basic IT topics. What is an IP address and what is a VPN anyway? In very simplified terms, an IP address in our example identifies an Internet access point. In my case, for example, this is currently 91.63.111.254 from the German Telekom. Due to the technical functionality behind it, we automatically send this IP to everyone, including Netflix, Amazon, booking.com, Google and all other providers, as soon as we use their services on the Internet or call up a website. This is not something the advertising industry or the government came up with for surveillance, this is just technical reality since several decades and will not change. It is similar to a sender address on a letter. Without it, you can’t deliver a reply.
A VPN is a virtual private network – private in the sense of non-public, not in the sense of privacy – and is used to connect private networks with each other or to provide access to a private network. The data traffic transmitted within it can be encrypted. Companies use VPN solutions, for example, to enable employees to access the company network from home via the Internet. A VPN is also often used to connect several company networks. The use of modern encryption techniques within the VPN also ensures the confidentiality and integrity of the transmitted data. Companies use solutions from hardware manufacturers such as Cisco and Juniper for this purpose – or use free open source software such as OpenVPN. The VPN providers mentioned at the beginning are not missing from this listing by mistake.
From a technical point of view, the use of a VPN provider can ensure that the website opened or the streaming service used no longer “sees” the actual IP address of your own Internet connection. Instead, it only receives an IP of the VPN provider as the remote station. Without evaluating this as an advantage or disadvantage, the use of such a VPN now brings the following technical features with it:
- the transmitted data is encrypted, at least from your own computer to the VPN provider
- your own IP address is not communicated to the service or provider (google, netflix, ..) you are using
From these two features, VPN providers now derive the following marketing promises.
Marketing Promise #1: Secure Internet
As described before, a VPN encrypts data – from the end device used to the end point of the VPN provider. After that, the data continues to be transmitted to the actual service used, as it would have been without a VPN.
If you use your online banking, Google, shop at Amazon, surf the daily news or read along here on the blog, the data is already encrypted – and thus secure – when it is transmitted over the Internet. The entire transmission path from the browser to the servers used to provide the service is already encrypted. While the use of SSL/TLS (https:// at the top of the browser bar) for encryption was rare in the past, it is now standard. Even if there are exceptions, a VPN provider also does not encrypt the entire data traffic, but only up to its endpoint. If the endpoint is in Russia and the destination in the USA, the data traffic is also transmitted across the globe without encryption.
The only advantage comes into play when the end device is being used in a public and insecure WIFI or WLAN. If you surf in a public Internet cafe on a non important insecure unencrypted website, then others can possibly intercept the data traffic. But you could also use the free Tor browser instead of paying for a VPN service. Solves the problem – if it really is a “problem” in the situation – and costs no money.
Marketing Promise #2: Privacy against user tracking
Advertisers use tracking via cookies, IP addresses, browser information, etc. to deliver personalized ads. Also the IP address of the used internet connection, but not only. Usually the IP used changes regularly even on one’s own connection, or one goes from home WIFI with a cell phone (IP from home), to the train using mobile data there (IP from mobile provider), goes to the company’s WIFI (IP from company), etc.
Using the IP to track a user is… a bad technical idea. There are exceptional cases where it may matter. Let’s say one has a fiber line at home with static IP (and pays the 400€ a month e.g. at Colt) and then wants to use video portals to view sexual acts. Yes, maybe I would use a VPN provider there as well. There is the question of how far it is relevant that a Cypriot company for adult online entertainment knows your own sexual wishes, but that would also bother me. Unfortunately, the VPN providers do not advertise this at all: Privacy at xHamster – keep secret that you like to lick dirty feet. Tell it only to us!
Marketing Promise #3: Remove Geo Fencing
There is a limited pool of IP addresses and they are assigned to companies or organizations. Companies have a location and thus sit in a country. Sometimes, the IP addresses used can be attributed not only to the country, but also to a rough location. Sometimes, rather inaccurate. Currently my IP address is assigned to the city of Munich, which is about 400km away from me. But the identification of the country works quite reliable. Germany, that is correct.
So as Netflix, for example, you can make sure that German customers can’t watch US movies on the American Netflix. This IP restriction can now be circumvented with a VPN provider, in the past you may used free proxies on the web for this. You simply select an endpoint of the VPN, which is located in America, for example. Netflix now thinks that you are an American customer. If you can now specify an American credit card, residence, etc., then this will work. Or you get stolen Netflix access data from America in the darknet and use a VPN provider that is located somewhere in the world, where American 3-letter agencies have no access to it. That’s not a call for it! But it is a use case. It’s just that no VPN provider advertises it here either: Use your stolen US Netflix credentials with DubiusVPN – 100% FBI protection!
Marketing promise #4: cheaper shopping
Other countries, other prices. Flights and hotels, for example, can cost less when marketed in Greece than in Germany. That’s not a rip-off at all, it’s a realistic pricing model and also depends on the costs in the respective country, the tax rates and laws there.
So far, so good, so if you want to book a vacation in Spain via a booking portal in Greece and you are sitting in Germany, a different price will be displayed there than in Germany – at least just because of the tax rates. A VPN can make sure that you can pretend to be a Greek user and book. Possibly one has again the problem with the indication of the domicile and the means of local payment. If one is successful, however, one has then also made the legal transaction in Greece and not in Germany. As soon as something goes wrong, it gets complicated. Nothing ever goes wrong on vacation: Flights are never cancelled. Hotel ratings are never fake.
For normal online shopping within a country, it doesn’t matter anyway. You can’t show potential customers from Kronberg am Taunus a higher price than customers from Frankfurt an der Oder. That is not technically possible, GEO-IP is too imprecise for that. What is technically possible, however, is to show customers with an iPhone a higher price than customers with a Google smart phone. However, no VPN provider would be able to help here.
Marketing Promise #5: Protection from DNS Leaks
Okay, I’ll let the VPN providers win: Anyone who sits in an Internet cafe (insecure WIFI) and calls up the website of his bank even encrypted has leaked something beforehand. His browser asks in the background via the DNS protocol, which IP address the servers of the bank website have. The moment one calls up the address in the browser. After that, all communication is secure and encrypted… but this information that you now wanted to know which IP addresses your bank’s server use for online banking – everyone there can see that. At least anyone with enough technical know-how and that is interested in it. If that bothers you, you could use a VPN provider – or just do online banking at home or from your work company.
Conclusion
I would not call the service of VPN providers a rip-off, but I find their marketing and advertising promises misleading. Their own representations of the advantages of VPN services in terms of security and privacy are not really wrong, but in context often without any further real benefit.
For most normal users, VPN services are unnecessary and so neither useful nor worth it. Those who really want or even need privacy should look at the Tor browser.
Those who use VPN services primarily to prepare or perform illegal actions (watching stolen Netflix accounts, script kiddie hacking) should not rely on the pseudo-anonymity of VPN services. There are more reliable ways of hiding yourself for this, which I can’t go into more depth here publicly. But the evil hacker (if he is good) does not use VPN services and the ethical hacker (in the sense of penetration testing) does not need it.
